Establishing a Crypto Trading Company - SPK Regulations Guide 2025

Establishing a crypto trading company in Turkey is a process regulated by Law No. 7518 "Law on Amending the Capital Markets Law" which came into effect on July 2, 2024. In this guide, we will examine in detail all legal requirements and processes for establishing a crypto asset service provider company.

🏛️ Legal Framework: Law No. 7518

SPK Regulation

The law published on July 2, 2024 created a clear legal framework for crypto asset service providers. According to this regulation:

• ✅ Crypto asset service providers are subject to SPK supervision
• ✅ License requirement has been introduced
• ✅ Capital adequacy conditions have been determined
• ✅ Customer protection measures have been defined

Scope of the Law

Under Law No. 7518, crypto asset service providers can carry out the following activities:

1. Crypto Asset Trading Platform Operation

   • Spot trading
   • P2P (peer-to-peer) transactions
   • OTC (over-the-counter) transactions

2. Crypto Asset Custody Service

   • Hot wallet management
   • Cold wallet storage
   • Multi-signature systems

3. Crypto Asset Transfer Service

   • Crypto asset transfers
   • Wallet management
   • Blockchain transactions

📋 Company Establishment Requirements

1. Company Type Requirement

According to Law No. 7518:

• ✅ Joint Stock Company (A.Ş.) establishment is mandatory
• ❌ Limited company (Ltd. Şti.) is not accepted
• ❌ Collective or limited partnership companies are not accepted

Reason: Joint stock company structure is preferred due to high capital requirements and corporate governance standards.

2. Capital Requirements

Minimum Paid-Up Capital:

• [fiyat bilgisi kaldırıldı] (Fifty Million Turkish Lira) paid-up capital requirement
• Capital must be entirely in cash
• In-kind capital is not accepted
• All shares must be registered shares

Capital Adequacy:

SPK may impose additional capital adequacy requirements for operation permit. These conditions:

• May vary depending on trading volume
• Depend on risk management requirements
• Must be sufficient to protect customer assets

3. Company Title

Mandatory Phrase:

The company title must include the phrase "crypto asset trading platform".

Example Titles:

• "ABC Crypto Asset Trading Platform A.Ş."
• "XYZ Crypto Asset Services A.Ş."

4. Share Structure

Share Characteristics:

• ✅ Must be registered (cannot be public)
• ✅ Must be issued for cash consideration
• ❌ In-kind capital is not accepted
• ❌ Cannot be offered to the public

📝 Licensing Processes

1. Establishment Permit

Application to SPK:

To establish a crypto asset service provider company, an establishment permit from SPK must first be obtained.

Application Documents (SPK Communiqué III-35/B.1 Article 8):

1. Draft Company Articles of Association

   • Title including "crypto asset trading platform" phrase
   • Capital structure (50 million TL)
   • Share structure (registered, cash)
   • Business activities exclusively as activities authorized by SPK

2. Business Plan and Feasibility Report

   • Market analysis
   • Competition analysis
   • Revenue projections
   • Risk analysis

3. Technical Infrastructure Report

   • Software architecture
   • Security measures
   • System capacity
   • Backup and disaster recovery plans

4. Risk Management System

   • Risk management policies
   • Internal control system
   • Compliance procedures
   • Audit mechanisms

5. Board of Directors Information

   • Board members' resumes
   • Compliance documents
   • Experience and competency evidence

6. Capital Proof

   • Bank deposit certificate
   • Capital commitment documents
   • Financial status report

2. Operation Permit

After obtaining establishment permit, a separate application must be made for operation permit.

Operation Permit Requirements (SPK Communiqué III-35/B.1 Article 9):

1. Information Systems Infrastructure

   • Compliance with Communiqué No. VII-128.10 (Procedures and Principles on Information Systems Management)
   • Compliance with TÜBİTAK Infrastructure Criteria
   • System tests must be completed
   • Security tests must be performed
   • Performance tests must be passed
   • Technical integration tests with MKK (Central Securities Depository) must be completed

2. Customer Asset Protection

   • Contract with SPK-authorized custody institution
   • Cold wallet infrastructure (95%+)
   • Secure storage of private keys (Communiqué III-35/B.2)
   • Multi-signature systems
   • Insurance coverage
   • Segregation system
   • Bank account opening for customer cash

3. KYC/AML Systems

   • Customer identification (KYC) system
   • Anti-money laundering (AML) system
   • Suspicious transaction reporting system
   • Risk assessment models

4. Personnel Competency (SPK Communiqué III-35/B.1 Articles 13-14):

   • General Manager: At least 7 years of professional experience in capital markets, information processing, information technologies or financial technologies
   • General Manager: Resident in Turkey, full-time, exclusively employed for this position
   • Personnel: At least 4-year undergraduate education (associate degree sufficient for operational personnel)
   • Compliance officer
   • Risk management specialist
   • Information security officer
   • Internal auditor
   • Internal control personnel
   • Technical team

⚖️ Legal Obligations

1. MASAK Notification

Under Law No. 5549:

Crypto asset service providers are considered obligated parties under the Law on Prevention of Laundering of Proceeds of Crime.

Obligations:

• ✅ Notification to MASAK (mandatory from May 1, 2025)
• ✅ Suspicious transaction reporting
• ✅ Customer identification (KYC) procedures implementation
• ✅ Record keeping (at least 5 years)
• ✅ Compliance officer appointment

2. KVKK Compliance

Personal Data Protection Law:

• ✅ Information obligation must be fulfilled
• ✅ Explicit consent must be obtained (when required)
• ✅ Data security measures must be taken
• ✅ Data processing records must be kept
• ✅ Data controller notification must be made

3. Tax Obligations

Income Tax:

There is no clear tax regulation yet for gains from crypto asset trading transactions. However:

• ⚠️ Income tax is probable (may be regulated in the future)
• ⚠️ Withholding tax may apply
• ✅ VAT applies to commission revenues (18%)

Corporate Tax:

For company revenues:

• ✅ Corporate tax is applied at 25%
• ✅ Withholding tax return must be filed
• ✅ Annual return must be filed

🔒 Security and Compliance Requirements

1. Cybersecurity

Mandatory Measures:

• ✅ ISO 27001 certificate (recommended)
• ✅ Penetration tests (at least 2 times per year)
• ✅ Security audits (regular)
• ✅ Cybersecurity insurance (recommended)

2. Customer Asset Protection

Cold Wallet:

• ✅ 95% of funds must be stored in cold wallets
• ✅ Multi-signature system must be used
• ✅ Geographic distribution (in different locations)
• ✅ Physical security measures

Hot Wallet:

• ✅ Minimum balance for daily transactions
• ✅ Automatic backup system
• ✅ Real-time monitoring and alarm system

3. Insurance

Recommended Insurance Types:

• ✅ Cybersecurity insurance
• ✅ Errors and omissions insurance
• ✅ Customer asset insurance
• ✅ Professional liability insurance

📊 Process Steps

Step 1: Preliminary Preparation (1-2 months)

1. Market Research

   • Competition analysis
   • Target audience determination
   • Business model development

2. Legal Consultancy

   • SPK regulations review
   • Company structure determination
   • Contract preparations

3. Technical Preparation

   • Software selection
   • Infrastructure planning
   • Security standards

Step 2: Company Establishment (2-4 weeks)

1. Notary Procedures

   • Articles of association preparation
   • Signature declarations
   • Capital commitment documents

2. Trade Registry Registration

   • MERSİS registration
   • Trade registry registration
   • Tax office registration

3. Bank Procedures

   • Company account opening
   • Capital deposit
   • Bank deposit certificate

Step 3: SPK Application (3-6 months)

1. Establishment Permit Application

   • Document preparation
   • Application to SPK
   • Review process
   • Permit decision

2. Technical Infrastructure Setup

   • Software installation
   • Security tests
   • System tests

3. Operation Permit Application

   • Completion of system tests
   • Application to SPK
   • Audit process
   • Permit decision

Step 4: Compliance Systems (1-2 months)

1. MASAK Notification

   • Online notification
   • System setup
   • Personnel training

2. KVKK Compliance

   • Data controller notification
   • Information texts
   • Security measures

3. Other Permits

   • ISO certificates
   • Insurance policies
   • Security certificates

Step 5: Launch (1-2 months)

1. Beta Testing

   • Limited user testing
   • System optimization
   • Security tests

2. Go-Live

   • System activation
   • User onboarding
   • Monitoring and optimization

⚠️ Things to Pay Attention To

❌ Prohibited Practices

• ❌ Use of crypto assets as payment instrument
• ❌ Operating without license
• ❌ Mixing customer assets
• ❌ Public offering (shares must be registered)

✅ Legal Practices

• ✅ Crypto asset trading platform operation
• ✅ Custody service provision
• ✅ Portfolio management services
• ✅ Consultancy services
• ✅ Education and content production

🎯 Recommendations for Success

1. Get Professional Support

• ✅ Legal consultancy (SPK regulations expert)
• ✅ Financial consultancy (tax and accounting)
• ✅ Technical consultancy (software and security)
• ✅ Compliance consultancy (MASAK, KVKK)

2. Allocate Sufficient Capital

• ✅ 50 million TL minimum capital
• ✅ Additional capital (for working capital)
• ✅ Reserve fund (for unexpected expenses)

3. Prioritize Security

• ✅ Cybersecurity measures
• ✅ Cold wallet infrastructure
• ✅ Regular audits
• ✅ Insurance coverage

4. Ensure Continuous Compliance

• ✅ Regulation tracking (SPK, MASAK, KVKK)
• ✅ Regular training
• ✅ Internal audits
• ✅ External audits

📞 Professional Support

Get professional support for establishing a crypto trading company:

✅ Legal consultancy (SPK regulations)
✅ Company establishment (notary, trade registry)
✅ Licensing processes (SPK applications)
✅ Compliance systems (MASAK, KVKK)
✅ Technical infrastructure (software, security)

Contact:

• 📧 iletisim@cesayazilim.com
• 📞 +90 850 225 53 34
• 💬 WhatsApp: Crypto Company Establishment

Note: This guide is provided free of charge for informational purposes only. No fees are required to access this content.## Conclusion

Establishing a crypto trading company in Turkey is a comprehensive process regulated by Law No. 7518. To be successful:

1. ✅ Sufficient capital (50 million TL)
2. ✅ Joint stock company structure
3. ✅ SPK license (establishment + operation permit)
4. ✅ MASAK notification
5. ✅ KVKK compliance
6. ✅ Strong security infrastructure
7. ✅ Professional team

Follow current regulations and get professional support. We are with you! 🚀

Frequently Asked Questions

What license is required to establish a crypto trading company in Turkey?

To establish a crypto trading company in Turkey, you need an SPK (Capital Markets Board) license under Law No. 7518. This includes both establishment permit and operation permit. The license process involves capital requirements (50 million TL minimum), company structure (joint stock company), and compliance with SPK regulations.

What is the minimum capital requirement for a crypto trading company?

The minimum capital requirement is 50 million Turkish Lira (TL) for crypto asset service providers. This capital must be fully paid and maintained throughout operations. Additional capital adequacy requirements may apply based on business volume and risk profile.

How long does it take to establish a crypto trading company?

The establishment process typically takes 6-12 months depending on license approval time, company setup, technical infrastructure development, and compliance verification. SPK license approval alone can take 3-6 months after submitting all required documents.

What are the main legal requirements for crypto trading companies?

Main legal requirements include SPK license (establishment + operation permit), MASAK notification (anti-money laundering), KVKK compliance (data protection), joint stock company structure, minimum 50 million TL capital, security infrastructure, KYC/AML systems, and ongoing regulatory compliance.

What is MASAK notification and why is it required?

MASAK (Financial Intelligence Unit) notification is mandatory for crypto trading companies to comply with anti-money laundering (AML) and combating financing of terrorism (CFT) regulations. Companies must report suspicious transactions and maintain transaction records as required by law.

Can foreign investors establish a crypto trading company in Turkey?

Yes, foreign investors can establish crypto trading companies in Turkey, but they must comply with foreign investment regulations, obtain necessary permits, and meet all SPK requirements. Foreign ownership restrictions may apply, and professional legal consultation is recommended.

What security measures are required for crypto trading companies?

Required security measures include cold wallet storage (90%+ of assets), multi-signature wallets, DDoS protection, 2FA for all users, KYC/AML systems, regular security audits, encryption, and incident response plans. Security infrastructure must meet SPK standards.

What happens if a crypto trading company doesn't comply with regulations?

Non-compliance can result in license revocation, fines, legal penalties, business closure, and criminal liability for executives. SPK has authority to suspend operations, impose fines, and take legal action against non-compliant companies. Regular compliance monitoring is essential.

Do I need technical expertise to establish a crypto trading company?

While technical expertise is not mandatory for company establishment, you'll need experienced developers, security experts, and compliance officers to operate successfully. Many companies partner with software development firms like Cesa Yazılım for technical infrastructure and ongoing support.

How much does it cost to establish a crypto trading company?

Total costs include 50 million TL minimum capital, license fees, legal and consulting fees (approximately 500K-2M TL), software development (1M-5M TL), security infrastructure (500K-2M TL), and ongoing operational costs. Professional support can help optimize costs and ensure compliance.